The UK's National Cyber Security Center (NCSC) announced the testing phase of a new service called Proactive Notifications, designed to inform organizations in the country of vulnerabilities present in their environment.

The service is delivered through cybersecurity firm Netcraft and is based on publicly available information and internet scanning.

The NSCS will identify organizations that lack essential security services and will contact them with specific software update recommendations that address unpatched vulnerabilities.

This may include recommendations on specific CVEs or general security issues, such as the use of weak encryption.

“Scanning and notifications will be based on external observations such as the version number publicly advertised by the software,” NCSC explains, adding that this activity is “in compliance with the Computer Misuse Act.”

The agency highlights that the emails sent through this service originate from netcraft.com addresses, do not include attachments, and do not request payments, personal, or other type of information.

BleepingComputer learned that the pilot program will cover UK domains and IP addresses from Autonomous System Numbers (ASNs) in the country.

The service will not cover all systems or vulnerabilities, though, and the recommendation is that entities do not rely on it alone for security alerts.

Organizations are strongly encouraged to sign up for the more mature ‘Early Warning’ service to receive timely notifications for security issues affecting their networks.

Early Warning is a free service from NCSC that alerts on potential cyberattacks, vulnerabilities, or other suspicious activity in a company's network.

It works by aggregating public, private, and government cyber-threat intelligence feeds and cross-referencing them with the domains and IP addresses of enrolled organizations to spot signs of active compromises.

Proactive Notification is triggered before a direct threat or compromise is detected, when NCSC becomes aware of a risk relevant to an organization’s setup.

Together, the two services will form a layered security approach.  Proactive Notification helps with hardening systems and reducing risks, while Early Warning will pick up what still manages to slip through.

The NCSC has not provided a timeline for the Proactive Notifications program exiting the pilot phase and becoming more broadly available.